Slashdot Mirror
Hackers Stole Customer Credit Cards in Newegg Data Breach (techcrunch.com)
Newegg is clearing up its website after a month-long data breach. TechCrunch: Hackers injected 15 lines of card skimming code on the online retailer's payments page which remained for more than a month between August 14 and September 18, Yonathan Klijnsma, a threat researcher at RiskIQ, told TechCrunch. The code siphoned off credit card data from unsuspecting customers to a server controlled by the hackers with a similar domain name -- likely to avoid detection. The server even used an HTTPS certificate to blend in. The code also worked for both desktop and mobile customers -- though it's unclear if mobile customers are affected.
The online electronics retailer removed the code on Tuesday after it was contacted by incident response firm Volexity, which first discovered the card skimming malware and reported its findings. Newegg is one of the largest retailers in the US, making $2.65 billion in revenue in 2016. The company touts more than 45 million monthly unique visitors, but it's not known precisely how many customers completed transactions during the period.
The online electronics retailer removed the code on Tuesday after it was contacted by incident response firm Volexity, which first discovered the card skimming malware and reported its findings. Newegg is one of the largest retailers in the US, making $2.65 billion in revenue in 2016. The company touts more than 45 million monthly unique visitors, but it's not known precisely how many customers completed transactions during the period.
lol
The last step of checkout has been glitchy for over a year. Though I have been using a card on file and only had to enter my CVV code multiple times or gave up and used PayPal.
It had one job to do.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
...one gold egg. Seriously, it was there for A MONTH and nobody noticed? Might be time to switch to a different site for my computer parts.
Came here to see if Paypal payments would be affected, I ordered stuff from them just a couple weeks ago using Paypal as the payment method (to work around Newegg's billing address restrictions).
"When information is power, privacy is freedom" - Jah-Wren Ryel
The usual advice is to not let the merchant store your credit card credentials — so they would not be stolen when the company's DB is.
This time, however, the people keeping their cards "on file" with Newegg were safe, whereas those, who entered the credentials anew, weren't...
In Soviet Washington the swamp drains you.
So the bad guys got a 3rd party certificate? Last time I got one (Codomo I think) for my mail server they actually verified my identity by phone in order to actually issue the certificate for me.
Is that not routine now? How could the bad guys not be traced if they want so far as to buy a cert?
I sleep better knowing that HTTPS has made us all safe from teh hax0rs.
Strange things are afoot at the Circle-K.
"Paying electronically is safer, Rick, you shouldn't use cash for anything, you'll just get mugged!", they said. "It's all secured with encrytion, nothing to worry about!", they said
What's next, you going to tell me the Equifax breach was 'fake news' and never happened?
"Oh, well, I don't buy things from Newegg so I feel perfectly safe!", they say to you
Seriously, folks, when is enough going to be enough for you all? It's objectively clear that electronic payment systems, regardless of whose they are, are not anything even close to secure. Leave the plastic at home (or at least leave it in your wallet), pay cash for things in person, and look for some way to at least limit your exposure to the overwhelming risk of paying electronically for anything, anywhere, ever. Do it starting TODAY. Plan on doing it for a long time to come, because these mentally challenged primates who run these systems apparently can't keep all the holes plugged.
The real breach is in that the attackers were somehow able to change the web page content to achieve this end. Do they know how the attackers accomplished this? If not, what's to stop it from reoccurring, even if not by the same people, when someone else figures it out?
File under 'M' for 'Manic ranting'
I really don't get the point of your post. New Egg sells computer and computer components. In today's economy a lot of it would be hard to find at a store, or you will need to buy it from a bunch of sources. Sure most of New Egg you can probably get at Amazon.
Do you just hate everything. As you type AC Posts on a hand me down Pentium?
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
This is what I read:
New Egg they messed up on one of your order. You were a jerk to them, so they had stopped feeding your trolling.
The phrase the Customer is Always Right, is just that a Phrase, not a rule. It isn't an excuse to be abusive to a company or an employee.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
I'm no authority, but as far as I can tell PayPal should be unaffected. It sounds like data was scooped off the front-end of the web site, i.e., from filling out the forms. But PayPal does not fill out forms; it sends data directly. So it should not be affected.
I am guessing also that my card number was not stolen since I used a saved number, rather than entering it in. However, Newegg always has you retype the CVV code, so that was definitely stolen in my case.
Incipiamus, fratres, servire Domino Deo, quia hucusque vix vel parum in nullo profecimus.
Here are the links to the original RiskIQ and Volexity reports on the breach.
RiskIQ: https://www.riskiq.com/blog/la...
Volexity: https://www.volexity.com/blog/...
They're conclusion is basically to get a new credit card number if you transacted with Newegg from 13 Aug through 18 Sep 2018.
Having just bought some things, I'm concerned, of course. Not to mention, newegg isn't remotely as good as they once were. Hell, I bought something on eBay and he shipped it two days faster and will get to me a week earlier than a similar order from newegg.
What are some good alternatives, outside of eBay and Amazon?
What if I paid using masterpass?
Many years ago (1998ish mabye?) I found out about Newegg and ordered a couple of sticks of RAM from them. They shipped me double what I ordered, and charged me for it. It was a nightmare to get my money refunded even AFTER I shipped back two sticks on my dime. It was such a bad experience that I swore I would never order from them again.
Fast forward a few years and I decided to give them another chance, and wow had they changed! They were my gold-standard for internet shopping experience. Fast, often free, shipping, perfect amount of communication and tracking, best prices, feature-rich search options, and fantastic review system.
Needless to say, I haven't bought anything from them for a few years now. It was caused by ordering something that I didn't realize was shipping directly from China. I still go to their site to find items and sometimes read the reviews, but I can now shop around once I find the item I want. Their reviews are still better than Amazon's, but Newegg just isn't close to what it used to be.
My beliefs do not require that you agree with them.
And when was Newegg going to inform their customers about this? Strange that we had to find out about this from a 3rd party news source. Does this only impact Newegg US, or other countries where Newegg does business affected too?
I've had newegg mess up a few of my orders. Every time they practically tripped all over themselves to make it right. I can complain about a few things from newegg, but my experience with their customer service isn't one of them.
I read at +2. If your post doesn't reach that level I will not see or respond to it.
Why would it be considered Libel?
I am not saying He is that or did that, I just interpreted his comment to have that meaning.
I would be Libel if I would to say Don't sell stuff to this guy, because he is a bad customer.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
I havn't use New Egg in over a decade.
But the Grandmother getting the kids the cheap ripoff is almost a trope.
But hey I am going to keep my Genuine Cook-e-man cards, they are going to be worth so much in the future.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
I'm no authority, but as far as I can tell PayPal should be unaffected. It sounds like data was scooped off the front-end of the web site, i.e., from filling out the forms. But PayPal does not fill out forms; it sends data directly. So it should not be affected.
I am guessing also that my card number was not stolen since I used a saved number, rather than entering it in. However, Newegg always has you retype the CVV code, so that was definitely stolen in my case.
I always use paypal when I can- partially for this reason. I hate when sites won't take paypal.
"That's the way to do it" - Punch
I'd actually suggest that the better way to handle payments is to reduce the value of the information transferred, namely, have the buyer's device generate a single-use token that can only be redeemed by the seller and can only be redeemed for the amount of the transaction(s). No credit card number that can be reused dozens of times. No PIN or security code. No home address. No name. Just a token that's useless once the transaction completes.
Apple Pay and other systems already do this transparently whether you use them in-person or online, which is great, since it both limits the scope of the damage (the most you could even possibly be on the hook for is that one transaction) and prevents a number of attacks from being possible in the first place (e.g. even if someone managed to scrape the token, they couldn't do anything with it).
There are still attacks that can be done against such systems, but most of them would revolve around replacing the seller's ID with your own in their system, thus redirecting the buyer's funds to your account. Doing so would reveal your hack immediately, however, since sellers tend to notice pretty quickly when they aren't getting paid.
And, as I said, Apple Pay isn't the only one doing this. In much the same way that some of us have used services that provide throwaway e-mail addresses to sign up for sites, there are "credit card" services that provide single-use credit card numbers that are only authorized for the amount of a given transaction. You can generate a one-off credit card number about as easily as you might fill in your password for a site from a password manager. They still have your other information attached, but they're a step in the right direction.
Big companies and small companies alike are addicted to WEBSTATS. It's hard to find a page out there that doesn't have 14 bits of Javascript code dedicated to giving better, targeted advertising and "customer service experience", so people would hardly be suspicious of code that sends information to "neweggstats.com".
There are HSTS headers that can be put on HTTPS pages to make sure the browser doesn't fall for this sort of thing, but using them tells the browser not to talk to those precious stat servers... so the stat-addicts won't.